Equifax: knowing about a vulnerability is not knowing it is patched

Equifax knew about the vulnerability and had told people to fix it. The gap was between instruction and verification.

A notice went out, a scan did not cover the affected system, and nobody established that the patch had actually been applied where it mattered. The lesson is not about that particular flaw. It is that a remediation process which ends at "we told them" has no idea what its own state is.